My new disappointment - MalwareBytes 3 update

[kimiraikkonen]

Hi there,

I was using "Malwarebytes AntiMalware Free (Home) edition currently with 2.2.1.1043" for ages which was the latest version build of v2.x series as far as i know. And i was updating definition database with existing version (2.2.1.1043) without any prompt of the newer Malwarebytes 3 installation just fine until today. Today i wanted to do the same and tried updating definition database, and the thing i was scaring happened as Murphy rule. The database updater also updated the main software AUTOMATICALLY and prompted me to install Malwarebytes 3!

After installation has been done successfully, i launched the Malwarebytes 3.3 (a new world for me), and the interface immediately was telling me that i'm in the trial period of MBAM Premium which i DID NOT CHOOSE any trial option! Because of this, many low-level drivers were also installed to the system which can be seen from the screenshot below highlighted red. Now i'm unable to exit/give up trial problem and real-protection, and the junks installed on my system.

Also MBAM service started to appear on services.msc (Windows Services Manager) as well.

Nightmare!

How can i JUST use free (not real time protection and those stuff) just like before?

Why did Malwarebytes FORCE me to use TRIAL and installed unwanted low-level virtual drivers for real-time protection which was not my wish?

How can i cleanly uninstall all these stuff, or is it necessarry?

Any help is greatly appreciated!

Thanks!

[Porthos]

5 hours ago, kimiraikkonen said:

How can i JUST use free (not real time protection and those stuff) just like before?

https://support.malwarebytes.com/docs/DOC-1033

[kimiraikkonen]

1 hour ago, Porthos said:

https://support.malwarebytes.com/docs/DOC-1033

Thanks for the link. So, you confirm that 14-day preimum trial is activated automatically by default  during regular installation without asking user, having possibility of deactivation later?

If i remove trial feature, will the real-time protection components such as virtual filesystem drivers and Malwarebytes services be also uninstalled? I don't think so. So it is not a good installation behaviour.

[Porthos]

24 minutes ago, kimiraikkonen said:

So, you confirm that 14-day preimum trial is activated automatically by default  during regular installation without asking user, having possibility of deactivation later?

Yes

25 minutes ago, kimiraikkonen said:

If i remove trial feature, will the real-time protection components such as virtual filesystem drivers and Malwarebytes services be also uninstalled? I don't think so. So it is not a good installation behaviour.

3

Can comment on that. I have not ever used the free version and will always use the paid version. 

[dcollins]

Yes, the 14 day trial is activated by default and can be deactivated if you choose.

When you revert to the free version, it will remove all unneeded drivers as well. There are still some that are needed, I'm pretty sure it's only MBAMSwissArmy though

[kimiraikkonen]

1 hour ago, dcollins said:

Yes, the 14 day trial is activated by default and can be deactivated if you choose.

When you revert to the free version, it will remove all unneeded drivers as well. There are still some that are needed, I'm pretty sure it's only MBAMSwissArmy though

Thank you for your input mate. I'll leave it until Malwarebytes consumes 14-day trial period then decide what to do.

I found some strange behaviour bugs about auto-restart feature in conjunction with Malwarebytes Windows Service (mbamservice.exe), which i'll explain later.

Cheers.

[kimiraikkonen]

On Tuesday, November 07, 2017 at 9:29 PM, dcollins said:

Yes, the 14 day trial is activated by default and can be deactivated if you choose.

When you revert to the free version, it will remove all unneeded drivers as well. There are still some that are needed, I'm pretty sure it's only MBAMSwissArmy though

Hi dcollins again,

I decided to try Preimum version for 14-days and what i would like to know is whether these real-time protection drivers (device manager shows them above) and MBAM Windows Service  (services.msc shows it too) will still remain on the system even after 14-day trial period ends by the start of free version without performing any uninstallation, and leaving the system as is.

Before trial ends, i'd like to know it and know actions that i should take though they're not harmful as i know.

Best regards.

[dcollins]

Once the trial ends, the real time protection drivers will go away. However the Malwarebytes Service will stay there as that's how all the scanning is performed. If you don't want the Malwarebytes service running, you can simple quit Malwarebytes from the system tray icon and it will stop running until you start it again

[kimiraikkonen]

On Tuesday, November 14, 2017 at 7:14 PM, dcollins said:

Once the trial ends, the real time protection drivers will go away. However the Malwarebytes Service will stay there as that's how all the scanning is performed. If you don't want the Malwarebytes service running, you can simple quit Malwarebytes from the system tray icon and it will stop running until you start it again

Hi dcollins again,

My trial period has just ended, today and Malwarebytes prompted me whether to continue with free version or upgrade to Premium plan for twice. I don't know why i was asked for twice, one prompt came from Malwarebytes Assistant from system tray, and another prompt came from main GUI window simultaneously. I confirmed for free version both. Strange. No matter, i desperately chose to continue with free version due to high pricing when compared to other brands' protection suites. Then Malwarebytes re-configured itself to run with free edition with no problem.

At this point i have one question related to my previous posts: I noticed real-time protection modules were not being loaded dynamically any longer as it's supposed, normally. Only mbamswissarmy.sys is being loaded into memory and drivers folder dynamically when i launch Malwarebytes as well. That's OK, too.

BUT, there is a driver residing in "c:\windows\system32\drivers" along with mbamswissarmy, that is mbae64.sys, first appeared when i installed Malwarebytes 3 two weeks ago. And it is not unloaded/uninstalled either when i quit Malwarebytes or when i reboot PC (start with Windows option is disabled, too). It still remains in drivers folder. Is it normal still to have mbae64.sys anti-exploit module eventhough real-time proetection is no longer available for me? Is it even required by Malwarebytes free version and does it need to be stored persistently in drivers folder?

I wish i could afford Premium version but pricing is almost 2x/3x more expensive in my country's currency than other world-wide alternatives.

Thanks for the support.

Edited November 21, 2017 by kimiraikkonen

[dcollins]

You can safely delete that file if you want. Most likely when you went from premium to free, you had a web browser open so that DLL couldn't unload properly and got left behind. I'll look into this issue to see if I can reproduce and find a way to handle it better in the future

[kimiraikkonen]

1 hour ago, dcollins said:

You can safely delete that file if you want. Most likely when you went from premium to free, you had a web browser open so that DLL couldn't unload properly and got left behind. I'll look into this issue to see if I can reproduce and find a way to handle it better in the future

Hi dcollins,

Thanks for your response. Sorry but no browser was open while i was switching to free version. As you know, mbae64.sys is Malwarebytes Anti-Exploit module driver that is also supposed to appear on device manager as virtual  (non-plug and play) driver, but in my case it only resides on "c:\windows\system32\drivers" folder with old modification date (Malwarebytes 3 installation date). Eventhough it may be OK to manually delete, i'm still hesisating to delete due to potential need of Malwarebytes as it seems to be an x64-based core driver file, so it would prevent a kind of MBAM-related system crash.

Could you please make a quick test and reproduce the behavior if you can, that would clarify my concern.

Best regards.

[dcollins]

@kimiraikkonen if the driver is no longer listed in device manager, the file can be safely deleted without concern. If you want to be 100% sure, you could rename the file temporarily, verify MB3 continues to work as expected, and then delete it eventually.

[kimiraikkonen]

27 minutes ago, dcollins said:

@kimiraikkonen if the driver is no longer listed in device manager, the file can be safely deleted without concern. If you want to be 100% sure, you could rename the file temporarily, verify MB3 continues to work as expected, and then delete it eventually.

Thank you for your reply, i appreciate. I'll mention my observations based on your suggestions.

Cheers.